Ensure xsrf protection is inserted at the end of application controller